"Each returned URL is unique and valid for a single usage, under the specified conditions." Where and how is the url actually invalidated after it is used? (or

"Each returned URL is unique and valid for a single usage, under the specified conditions." Where and how is the url actually invalidated after it is used? (or are you relying on expiration as invalidation?)